IN THE CLAIMS 



This listing of claims will replace all prior versions, and listings, of claims in the 
application: 
Listing of Claims: 

1. (Currently amended) A method of providing security, comprising: 

accessing a database configured to store operational information 
associated with a process; 

determining a first behavior using the operational information, wherein the 
first behavior is associated with the process; 

monitoring the process; and 

comparing a second behavior with the first behavior, wherein the second 
behavior is attempted by the process ; and 

performing a predetermined responsive action if the second behavior is 
different from the first behavior: 

wherein the operational information includes a list of one or more 
resources accessed bv the process in the course of a normal and permitted operation: and 
the database is used by the process in the course of said normal and permitted operation 
to enable the process to access said resources in an optimized manner . 

2. (Currently amended) [[A]] The method of providing security as recited in Claim 1, in 

[[the]] an event the second behavior is determined to be different from the first behavior, the 
second behavior is determined to be disallowed. 

3. (Currently amended) [[A]] The method of providing security as recited in Claim 1, 
wherein the first behavior is one of a plurality of behaviors determined using the operational 
information. 

4. (Currently amended) [[A]] The method of providing security as recited in Claim 1, 
wherein the first behavior is one of a plurality of behaviors determined using the operational 
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information, and in the event the second behavior is determined to be different from the plurality 
of behaviors, the second behavior is determined to be disallowed. 

5. (Currently amended) [[A]] The method of providing security as recited in Claim 1, 
further comprising determining that the second behavior is disallowed. 

6. (Currently amended) [[A]] The method of providing security as recited in Claim 1, 
further comprising determining that the second behavior is disallowed and performing a 
predetermined action. 

7. (Currently amended) [[A]] The method of providing security as recited in Claim 1, 
further comprising determining that the second b e havior is disallow e d and performing a 
pr e det e rmin e d action, wherein the predetermined action includes preventing the second behavior 
from succeeding. 

8. (Currently amended) [[A]] The method of providing security as recited in Claim 1, 
further comprising determining that the second behavior is disallowed and performing a 
pr e determin e d action, wherein the predetermined action includes generating an event associated 
with the second behavior. 

9. (Currently amended) [[A]] The method of providing security as recited in Claim 1, 
wherein determining the first behavior using the operational information is performed when the 
process is not operating. 

10. (Canceled) 

11. (Currently amended) [[A]] The method of providing security as recited in Claim 1, 
wherein the operational information includes optimization information, and the optimization 
information is used to improve process initialization time. 
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12. (Currently amended) [[A]] The method of providing security as recited in Claim 1, 
wherein the operational information includes optimization information, and wherein the 
optimization information is configured on a per user basis. 

13. (Currently amended) [[A]] The method of providing security as recited in Claim 1, 
wherein the operational information includes component access information. 

14. (Currently amended) [[A]] The method of providing security as recited in Claim 1, 
wherein the database includes a prefetch file. 

15. (Currently amended) [[A]] The method of providing security as recited in Claim 1, 
wherein the database includes a superfetch file. 

16. (Currently amended) A system for providing security, comprising: 

a processor configured to: 

access a database configured to store operational information 
associated with a process; 

determine a first behavior using the operational information, 
wherein the first behavior is associated with the process; 

monitor the process; and 

compare a second behavior with the first behavior, wherein the 
second behavior is attempted by the process; and 

perform a predetermined responsive action if the second behavior 
is different from the first behavior: and 

a memory coupled with the processor, configured to provide the processor 
with directions; 

wherein the operational information includes a list of one or more 
resources accessed by the process in the course of a normal and permitted operation: and 
the database is used bv the process in the course of said normal and permitted operation 
to enable the process to access said resources in an optimized manner . 
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17. (Currently amended) A computer program product for providing security, the computer 
program product being embodied in a computer readable medium and comprising computer 
instructions for: 

accessing a database configured to store operational information 
associated with a process; 

determining a first behavior using the operational information, wherein the 
first behavior is associated with the process; 

monitoring the process; and 

comparing a second behavior with the first behavior, wherein the second 
behavior is attempted by the process ; and 

performing a predetermined responsive action if the second behavior is 
different from the first behavior; 

wherein the operational information includes a list of one or more 
resources accessed bv the process in the course of a normal and permitted operation; and 
the database is used bv the process in the course of said normal and permitted operation 
to enable the process to access said resources in an optimized manner . 

18. (Canceled) 

19. (Canceled) 

20. (Canceled) 
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